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DETAILED ACTION 
Allowable Subject Matter 

Claims 1-5 are allowed. 

The following is an examiner's statement of reasons for allowance: 

As per claim 1 , the prior art of record does not teach or suggest a 
combination as claimed, in which the modulus p is selected from the group of 
equations as specified in step (a), to be utilized in the method for identifying 
users, described in steps (b) through (o). The prior art described in page 6 of 
applicant's Background of the Invention discloses the use of a class of numbers 
in the form of 2 q -C chosen to create a more efficient modular reduction, to be 
utilized in a method for identifying users. At the time of the invention, there would 
be no motivation for a person of ordinary skill in the art to use the applicant's 
combination. Therefore, claim 1 is allowable. 

Claims 2-5 are is allowable because they are dependent on allowable 
claim 1. 

Interview Summary 

Please refer to the Examiner's "Annotated Marked-Up Drawings" included 
as pages 3-6 of this office action for changes made to Figures 1-3, 5, and 6 as 
per Attorney's request. 
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SELECT MODULI 
p=(2 A dk-2 A ck-l 
p=(2 A dk-2 A (d-l] 
p=(2 A dk-2 A ck-l 
p=(2 A dk-2 A ck+l)/r, where r/=l; AND 
p=(2 A 4k-2 A 3k+2 A 2k+l)/r 



p FROM FORMS: 
here r/=l, 0<=2c<=d; 
A (d-2)k-...-2 A k+l)/r; 
here r/=l, 3d<=6c<=4d; 



2 | 



SELECfcURVE E AND ORDER q 



3_f3&»* S 

~~ J SELECT BASEPOINTG 



4 I 



nrt^ 

GENERATE PRIVATE KEY w 



5 r 



GENERATEIPUBLIC KEY W=wG 



sfr* 

DISTRIBUTE p, E, q, G, W 
IN AUTHENTIC MANNER 



FIG. 1 
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7 f 



PROVER RETRIEVES ITS PRIVATE KEY w 



8 — | VERIFIER RETRIEVES PROVER'S PUBLIC KEY W 



9 — I PROVER GENERATES PRIVATE INTEGERf k 



10 




PROVER COMBINES kAND G TO FORM K 
USING FORM OF Mfl^LUS p SELECTED 



11 



— PROVER SENDS K TO VERIFIER 



12_ 

13_ 
14 

15 



VERIFIER SENDS CHALLENGE 
INTEGER c TO PROVER 



PROVER COMBINES 
TO FORM RESPONSi 




— PROVER SENDS v TO VERIFIER 



VERIFIER COMBINES cG, K, AND W 
USING FORM OF MODULUS P SELECTED 
AND CHECKS EQUALITY WITH vG 



FIG. 2 
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16_ 
17. 
18_ 

19_ 

20_ 

21 



SIGNER RETRIEVES ITS PRIVATE KEY w 



— SIGNER GENERATES PRIVATE INTEGER k 



SIGNER COMBINE 
USING FORM OF 





G TO FORM K 
US p SELECTED 



SIGNER COMBINES K AND MESSAGE 
M TO FORM INTEGER h 



SIGNER COMBINES hi to AND 
w TO FORM INTEGERv^/ 



SIGNER SENDS MESSAGE M 
ALONG WITH SIGNATURE (K,s) 



FIG. 3 



VERIFIER RETRIEVES PROVER'S PUBLIC KEY W 








VERIFIER RECEIVES MESSAGE M 
ALONG WITH SIGNATURE (K,s) 










VERIFIER COMBINES K AND 
MESSAGE M TO FORM INTEGER h 










VERIFIER COMBINES h, K, AND W USING 
FORM OF MODULUS p SELECTED AND 
CHECKS EQUALITY OF RESULT WITH sG 



FIG. 4 
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26. 

27. 

28_ 
29_ 
30_ 
31 



— SIGNER RETRIEVES ITS PRIVATE KEY w 



— SIGNER GENERATES PRIVATE INTEGER k 




SIGNER COMBINES kjAfND G TO FORM K 
USING FORM OF MODULUS p SELECTED 



SIGNER COMBINES K AND MESSAGE 
M TO FORM INTEGER h 



SIGNER COMBINES 
w TO FORM INTEGEl 




i,l£A/!D 



SIGNER SENDS MESSAGE M 
ALONG WITH SIGNATURE (h,s) 



FIG. 5 



32 — I VERIFIER RETRIEVES PROVER'S PUBLIC KEY W 



33 



34 



35 



36. 



VERIFIER RECEIVES MESSAGE M 
ALONG WITH SIGNATURE (h,s) 



VERIFIER COMBINES h, W, AND sG USING 
FORM OF MODULUS p SELECTED TO FORM K 



VERIFIER COMBINES K AND MESSAGE 
M TO FORM INTEGER h" 



VERIFIER CHECKS EQUALITY OF h AND h* 



FIG. 6 
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EXAMINER'S AMENDMENT 

An examiner's amendment to the record appears below. Should the 
changes and/or additions be unacceptable to applicant, an amendment may be 
filed as provided by 37 CFR 1 .312. To ensure consideration of such an 
amendment, it MUST be submitted no later than the payment of the issue fee. 

Authorization for this examiner's amendment was given in a telephone 
interview with Attorney Robert D. Morelli on January 12, 2005. 

Please amend Claims in accordance with Examiner's "Claim J 
Amendments" included as pages 8-14 of this office action. 

Please amend Specifications in accordance with Examiner's "Specification 
Amendments" included as pages 15-27 of this office action. 

The following changes to the drawings have been approved by the 
examiner and agreed upon by applicant: Please replace Figures 1-6 with 
Examiner's "Replacement Sheet" Figures 1-6 as included in pages 28-31 of this 
office action. 
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CLAIM AMENDMENTS 

Claim 1 (currently amended): A method of identifying a user, comprising the 
steps of: 

a) selecting , bv the user, a modulus p from the group of equations 
consisting of: 

where 0<2c<=d, where rf= does not equal 1 , and where GCD(c, c0=1 ; 

where d is even, and where k is not equal to 2 (mod 4); 

p=(2 dk -2*-1)/r, 
where 3d<6c<4d, and where GCD(c,d)=V, 

where 0<2c<=d, where r/= does not equal 1 , and where GCD(c,d)^ ; and 
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b) selecting , by the user, an elliptic curve E and an order q\ 

c) selecting , by the user, a basepoint G; 

d) generating , bv the user, a private key w\ 

e) generating , bv the user, a public key W=wG\ 

f) distributing , bv the user, p. E, q, G, and W in an authentic manner; 

g) r e tr ie v i ng generating , by a prover, the prover's private key w Wp and 
public key Wp and distributing Wp : 

h) retrieving, by a verifier, the prover's public key WWp\ 

i) generating, by the prover, a private integer k kp\ 

j) combining, by the prover, k kp and th e prov e r's G to form K using the 
form of the prov e r's modulus p; 

k) sending, by the prover, K to the verifier; 

I) sending, by the verifier, a challenge integer c to prover; 

m) combining, by the prover, c, kkp y and w Wp to form a response integer 

n) sending, by the prover, y to the verifier; and 

o) combining, by the verifier, cG, K, and WWp using the form of the 

provor's modulus p and checking to see if the combination is equal to vG, if so 
the user is identified as the user, otherwise the user is not identified as the user. 
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Claim 2 (currently amended): The method of g e n e rat i ng a d i gita l s i gnatur e claim 
1, further comprising the steps of: 

a) sele ct i ng a modu l u s p from th e group of e quat i ons cons i st i ng of: 

whoro 0<2o<-d, wh e r e rh 1, and whoro GCD(c,d)-'\; 

p-(2^ 2 (d ~ m +2 ( * i ^ k 2*+1)/r , 
wh e r e d i s e v e n, and wh e r e k i s not e qua l to 2 (mod 4 ); 

wh e r e Zd<6c<4d, and whoro GCDfaG()-1; 

wh e r e 0<2c-d, whoro rh 1, and whor e GCD(c,d)-1; and 
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b) s ele ct i ng an ell ipt i c curv e E and an ord e r q, 

c) s e l e ct i ng a bas e po i nt G; 

d) gonorating a private k e y w; 

e) g e n e rating a pub li c k e y W~wG; 

f) d i str i buting p, E, q, G, and Win an authent i c manner; 

&a) r e tr ie v i ng generating , by a signer, the signer's private key w vv s ; 
ftb) generating, by the signer, a private integer k /c s ; 

ic) combining, by the signer, k k§ and G to form K using the form of the 

p rov e r's modulus p; 

jd) combining, by the signer, K and a message M to form an integer h; 

ke) combining by the signer, h, k k s , and w w§ to form an integer s; and 
If) sending, by the signer, M and (K,s) as a digital signature of M. 

Claim 3 (currently amended): The method of claim 4 2, further including the steps 
of: 

a) retrieving, by the verifier, the prover's public key WWp, 

b) receiving, by the verifier, Mand (K,s); 

c) combining, by the verifier, K and M to form an integer h; and 
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d) combining, by the verifier, h, kK, and WWp using the form of the provor's 

modulus p and checking to see if the combination is equal to sG, if so then the 
digital signature is verified, otherwise the digital signature is not verified. 

Claim 4 (currently amended): The method of g e n e rat i ng a digita l s i gnature claim 
1, further comprising the steps of: 

a) s ele ct i ng a modu l us p from th e group of e quations cons i sting of: 

wh e r e 0<2c<~d, whoro rh 1 , and wh e r e GCD(o,d)-Y, 

wh e r e d i s e v e n, and wh e r e k i s not equa l to 2 (mod A); 

wh e r e Zd<6c<Ad, and wh e r e GCD(c,d)—\ ; 
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wh e r e 0<2c<-d, wh e r e rh 1, and wh e re GCDfad)-^ and 

b) s ele ct i ng an elli pt i c curv e E and an ord e r q\ 

c) s e l e ct i ng a bas e po i nt G; 

d) g e n e rat i ng a pr i vat e k e y w\ 

e ) g e n e rat i ng a pub l ic k e y W~wG\ 

f) d i str i but i ng p, E, q, G, and W i n an auth e nt i c mann e r; 

§a) rotr i oving generating , by a signer, the signer's private key w vv s ; 
bb) generating, by the signer, a private integer k k s \ 

ic) combining, by the signer, k k s and G to form K using the form of the 

prov e r's modulus p; 

jd) combining, by the signer, K and a message M to form an integer /?; 

ke) combining by the signer, h, k k s , and w w$ to form an integer s; and 
If) sending, by the signer, M and (h,s) as a digital signature of M. 

Claim 5 (currently amended): The method of claim 4, further including the steps 
of: 

a) retrieving, by the verifier, the prover's public key WWp\ 
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b) receiving, by the verifier, /Wand (h,s); 

c) combining, by the verifier, h, WWp, and sG using the form of the 

prov e r's modulus p to form K; 

d) combining, by the verifier, K and M to form an integer h'\ and 

e) checking, by the verifier, that h is equal to h', if so then the digital 
signature is verified, otherwise the digital signature is not verified. 
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SPECIFICATION AMENDMENTS 

(Replace third full paragraph on page 2 with the following paragraph.) The use 
of cryptographic key pairs was disclosed in U.S. Pat. No. 4,200,770, entitled 
"CRYPTOGRAPHIC APPARATUS AND METHOD." U.S. Pat. No. 4,200,770 also 
disclosed the application of key pairs to the problem of key agreement over an insecure 
communication channel. The algorithms specified in this U.S. Pat. No. 1,200,700 
4,200J70 rely for their security on the difficulty of the mathematical problem of finding 
a discrete logarithm. U.S. Pat. No. 4,200,770 is hereby incorporated by reference into the 
specification of the present invention. 

(Replace the first full paragraph on page 7 with the following paragraph.) 
It is an object of the present invention to efficiently create a digital signature using 
a modulus p selected from the following families of equations: 

p=(2 dk -2 ck -1)/r, 

where 0<2c<=d, where r/= does not equal to 1, and where GCD(c,d)=1, where 
GCD is a function that returns the greatest common denominator between the 
variables in parenthesis; 

p=(2 dk -2 (d ' 1,k +2 (d ' 2)k -. . . -2*+ 1)/r, 
where d is even, and where k is not equal to 2 (mod 4); 
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where 3d<6c<4d, and where GCD(c,d)=Y, 



p=(2 



+1)/r, 



where 0<2c<=d, where r/= does not equal to 1, and where GCD(c,d)=Y, and 



(Replace the first full paragraph on page 8 with the following paragraph.) 
The first step through sixth step are done by each user who wishes to have its 
message digitally signed. The first step is selecting a modulus p from the 
following family of equations: 



where 0<2c<=d, where r/= does not equal to 1. and where GCD(c,d)=1; 



1)/r, 



p=(2> 




where d is even, and where k is not equal to 2 (mod 4); 
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p=(2 aK -? K -1)/r, 
where 3d<6c<4d, and where GCD(c,d) =, \; 

p=(?*-2*+1)/r, 

where 0<2c<=d, where r/= does not equal to 1 , and where GCD(c,d)=1 ; and 

(Replace the sixth full paragraph on page 9 with the following paragraph.) 
The seventh step through fifteenth step are done to identity the user who wishes 
to have a message digitally signed. The seventh step is a prover retr i ev i ng 

generating its private key w wp and public key Wp =w pG. and distributing its Wp . 

(Replace the seventh full paragraph on page 9 with the following 
paragraph.) The eighth step is a verifier retrieving the prover's public key WWp. 

(Replace the eighth full paragraph on page 9 with the following 
paragraph.) The ninth step is the prover generating a private integer k kp. 
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(Replace the ninth full paragraph on page 9 with the following paragraph.) 
The tenth step is the prover combining kkp and prov e r's G to form K using the 

form of the prov e r's modulus p. 

(Replace the twelfth full paragraph on page 9 with the following 
paragraph.) The thirteenth step is the prover combining c, kkp, and wwp to form 

a response integer v. 

(Replace the fourteenth full paragraph on page 9 with the following 
paragraph.) The fifteenth step is the verifier combining cG, K, and WWp using 

the form of the prov e r's modulus p and checking to see if the combination is 
equal to vG. If the combination is equal to vG then the prover is properly 
identified. Otherwise, the prover is not properly identified. 

(Replace the fifteenth full paragraph on page 9 with the following 
paragraph.) The sixteenth step through the twenty-first step are done by the 
person digitally signing a message. The sixteenth step is a signer r e tr ie v i ng 

generating its private key w vv s . 



(Replace the sixteenth full paragraph on page 9 with the following 
paragraph.) The seventeenth step is the signer generating a private integer kk s . 
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(Replace the seventeenth full paragraph on page 9 with the following 
paragraph.) The eighteenth step is the signer combining k k$ and G to form K 

using the form of the prov e r's modulus p. 

(Replace the second full paragraph on page 10 with the following 

paragraph.) The twentieth step is the signer combining h, kk s , and ww s to form 
an integer s. 

(Replace the fourth full paragraph on page 10 with the following 
paragraph.) The twenty-second step through the twenty-fifth step are done by the 
person verifying the digital signature. The twenty-second step is the verifier 

retrieving the prover's public key WWp. 

(Replace the seventh full paragraph on page 10 with the following 
paragraph.) The twenty-fifth step is the verifier combining h, kK, and WWp 

using the form of the provor's modulus p and checking to see if the combination 
is equal to sG. If so, then the digital signature is verified. Otherwise, the digital 
signature is not verified. 

(Replace the eighth full paragraph on page 10 with the following 
paragraph.) The twenty-sixth step through the thirty-first step are alternative 
steps for digitally signing a message. The twenty-sixth step is a signer retrieving 

its private key w vt£. 
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(Replace the ninth full paragraph on page 10 with the following 
paragraph.) The twenty-seventh step is the signer generating a private integer k 

Us- 

(Replace the tenth full paragraph on page 10 with the following 
paragraph.) The twenty-eighth step is the signer combining kk s and G to form K 

using the form of the prov e r's modulus p. 

(Replace the twelfth full paragraph on page 10 with the following 
paragraph.) The thirtieth step is the signer combining h, k and ww s to form 

an integer s. 

(Replace the thirteenth full paragraph on page 10 with the following 
paragraph.) The th i rty s e cond thirty-first step through thirty-sixth steps are 
alternative steps for verifying the digital signature of the alternative signing steps. 
The thirty-first step is the signer sending the message M and the digital signature 
(A?,s) of M. 

(Replace the fourteenth full paragraph on page 10 with the following 
paragraph.) The thirty-second step is the verifier retrieving the prover's public key 

Wl/l/n. 
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4 

(Replace the first full paragraph on page 1 1 with the following paragraph.) 



the provor's modulus p to form K. 

(Replace the last paragraph on page 1 1 with the following paragraph.) 
The present invention is a method of identifying a user, generating a digital 
signature for a message of the user, and verifying the digital signature in an 
efficient manner (i.e., in fewer steps than the prior art) using a modulus p 
selected from the following family of equations: 



where 0<2c<=d, where r/= does not equal 1 , and where GCD(c.d)^ ; 



The thirty-fourth step is the verifier combining h, W W, 



f _p, and sG using the form of 



p=(2 aK -2 CK -1)/r, 



p=(2 




where d is even, and where k is not equal to 2 (mod 4); 



p='(2*-2*-1)A; 



where 3d<6c<4d, and where GCD(c,d)=Y, 



p=(2r-2r+1)/t, 
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where 0<2c<=d, where r/= does not equal 1 , and where GCD(c,d)^ ; and 

(Replace the last paragraph on page 1 3 with the following 
paragraph.) The first step 1 of the present method is selecting a modulus p from 
the following family of equations: 

p =(2? k -2 0k -1)/r, 

where 0<2c<=d, where r/= does not equal 1, and where GCD(c,d)^; 

p=(2 dk -2 (d ~ 1)k +2 (d ~ 2)k - -2 k +1)/r 
where d is even, and where k is not equal to 2 (mod 4); 

where 3d<6c<4d, and where GCD(c,d)^ ; 

where 0<2c<=d, where r/= does not equal 1 , and where GCD(c,d)^ ; and 

p=(2 4k -2 3k +2 2k +1)/r. 
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(Replace the seventh full paragraph on page 14 with the following 
paragraph.) The seventh step 7 of the method is a prover r e tr ie v i ng generating its 

private key w Wp and public key Wp-WpG and dirstibuting Wp . 

(Replace the eighth full paragraph on page 14 with the following 
paragraph.) The eighth step 8 of the present method is a verifier retrieving the 

prover's public key WWp. 

(Replace the ninth full paragraph on page 14 with the following 
paragraph.) The ninth step 9 of the present method is the prover generating a 

private integer kkp. 

(Replace the first full paragraph on page 15 with the following paragraph.) 
The tenth step 10 of the present method is the prover combining kkp and 

prover's G to form K using the form of the p rov e r's modulus p. 

(Replace the third full paragraph on page 15 with the following 
paragraph.) The twelfth step 12 of the present method is the verifier sending a 
challenge integer c to the prover. 
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(Replace the fourth full paragraph on page 15 with the following 
paragraph.) The thirteenth step 1 3 of the present method is the prover combining 

c, k kp y and w wp to form a response integer v. 

(Replace the sixth full paragraph on page 15 with the following 
paragraph.) The fifteenth step 15 of the present method is the verifier combining 

cG, K, and W Wp using the form of the prov e r's modulus p and checking to see if 

the combination is equal to vG. If the combination is equal to vG then the prover 
is properly identified. Otherwise, the prover is not properly identified. 

(Replace the eighth full paragraph on page 15 with the following 
paragraph.) The sixteenth step 16 of the present method is a signer retrieving its 

private key w w s . 

(Replace the ninth full paragraph on page 15 with the following 
paragraph.) The seventeenth step 17 of the present method is the signer 

generating a private integer k k s . 

(Replace the tenth full paragraph on page 15 with the following 
paragraph.) The eighteenth step 18 of the present method is the signer 

combining k /c s .and G to form K using the form of the s i gn e r's modulus p. 
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(Replace the twelfth full paragraph on page 15 with the following 
paragraph.) The twentieth step 20 of the present method is the signer combining 

h, k !<$, and w vv§.to form an integer s. 

(Replace the second full paragraph on page 16 with the following 
paragraph.) The twenty-second step 22 of the present method is the verifier 

retrieving the prover's public key WWp. 

(Replace the fifth full paragraph on page 16 with the following paragraph.) 
The twenty-fifth step 25 of the present method is the verifier combining h, kK, 

and WWp using the form of the prov e r's modulus p and checking to see if the 

combination is equal to sG. If so, then the digital signature is verified. Otherwise, 
the digital signature is not verified. 

(Replace the seventh full paragraph on page 16 with the following 
paragraph.) The twenty-sixth step 26 of the present method is a signer retrieving 

its private key ww s . 

(Replace the eighth full paragraph on page 16 with the following 
paragraph.) The twenty-seventh step 27 of the present method is the signer 

generating a private integer k k s . 
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(Replace the ninth full paragraph on page 16 with the following 
paragraph.) The twenty-eighth step 28 of the present method is the signer 

combining k k$ and G to form K using the form of the s i gn e r's modulus p. 

(Replace the eleventh full paragraph on page 16 with the following 
paragraph.) The thirtieth step 30 of the present method is the signer combining h, 

k k s , and w w s to form an integer s. 

(Replace the second full paragraph on page 17 with the following 
paragraph.) The thirty-second step 32 of the present method is the verifier 

retrieving the prover's public key WWp. 

(Replace the fourth full paragraph on page 17 with the following 
paragraph.) The thirty-fourth step 34 of the present method is the verifier 

combining h, WWp, and sG using the form of the prov e r's modulus p to form K. 

(Replace the first full paragraph on page 24 with the following paragraph.) 
A method of identifying user, generating digital signature, and verifying digital sig- 
nature by selecting a modulus p in the form of p=(2 dk -2 ck -1)/n p=(2 dk - 2 (d ' 1)k +2 (d - 
2)k ~...-?+1)/n p=(2 dk -¥ k -1)/r % p=(2 dk -2 ck +1)/n and p=(2 4k -2 3k +2 2k +1)/r } selecting an 
elliptic curve E and an order q\ selecting a basepoint 6; generating a private key 
w\ generating a public key W=wG; distributing p, E, q s G, and l/l/ to at least a 
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proven a verifier, and a signer : r e tr ie v i ng generating a the prover's private key w 
Wp and public key Wp =WpG: retrieving the prover's public key WWp] generating 

a private integer k kp\ combining k kp and th e prov e r's G to form K using the 

prov e r's modulus p; sending K to the verifier; sending a challenge integer c to the 
prover; combining c, kkp } and w Wp to form a response integer v\ sending v to 

the verifier; combining cG, K, and WWp using tho prov e r's modulus p and 

checking to see if the combination is equal to vG. If not so, stop. Otherwise, 
r e tr ie v i ng generating, by the signer the signer's private key w w s \ generating a 

private integer k combining kk s and G to form K using the prov e r's modu l us 

p; combining K and a message M to form an integer h\ combining h, k /($, and w 

w s to form an integer s; sending M and (K,s) as a digital signature of M\ 

retrieving th e prov e r's pub li c k e y WWp] receiving M and (K,s); combining Kand 

Mto form an integer h\ and combining h, kK % and WWp using th e prov e r's 

modu l us p and checking to see if the combination is equal to sG. If so, the digital 
signature is verified. 
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'REPLACEMENT SHEET" 



SELECT MODULUS p FROM FORMS: 
p=(2 A dk-2 A ck-l)/ri where r does not equal I, 0<=2c<=d; 
p=(2 A dk-2 A (d- 1 )k+2 A (d-2)k-. . .-2 A k+ 1 )/r; 
p=(2 A dk-2 A ck-l)/r, where r does not equal 1, 3d<=6c<=4d; 
p=(2 A dk-2 A ck+l)/r, where r does not equal 1; AND 
p=(2 A 4k-2 A 3k+2 A 2k+ 1 )/r 



SELECT CURVE E AND ORDER q 



3_J 



X 



SELECT BASEPOINT G 



GENERATE PRIVATE KEY w 



GENERATE PUBLIC KEY W=wG 



6 I 



DISTRIBUTE p, E, q, G, W 
IN AUTHENTIC MANNER 



FIG. 1 
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"REPLACEMENT SHEET" 



7_ 



PROVER GENERATES w p AND W p AND DISTRIBUTES Wp 



VERIFIER RETRIEVES PROVER'S PUBLIC KEY W r 



9_ 
10_ 

11_ 

12_ 

13_ 
14 



PROVER GENERATES PRIVATE INTEGER k r 



PROVER COMBINES k p AND G TO FORM K 
USING FORM OF MODULUS p SELECTED 



T 



— PROVER SENDS K TO VERIFIER 



VERIFIER SENDS CHALLENGE 
INTEGER c TO PROVER 



PROVER COMBINES c, k p AND w p 
TO FORM RESPONSE INTEGER v 



— PROVER SENDS v TO VERIFIER 



15 



VERIFIER COMBINES cG, K, AND W p 

USING FORM OF MODULUS P SELECTED 
AND CHECKS EQUALITY WITH vG 



FIG. 2 
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"REPLACEMENT SHEET" 



16_ 
17. 

18_ 
19_ 
20 
21 



1 — I SIGNER GENERATES w p AND W p AND DISTRIBUTES Wp 



I 



SIGNER GENERATES PRIVATE INTEGER k s 



SIGNER COMBINES k s AND G TO FORM K 
USING FORM OF MODULUS p SELECTED 



SIGNER COMBINES K AND MESSAGE 
M TO FORM INTEGER h 



SIGNER COMBINES h, k s , AND 
w s TO FORM INTEGER s 



SIGNER SENDS MESSAGE M 
ALONG WITH SIGNATURE (K,s) 



FIG. 3 



22 — I VERIFIER RETRIEVES PROVER'S PUBLIC KEY W p 



23 



24 



25 



I 



VERIFIER RECEIVES MESSAGE M 
ALONG WITH SIGNATURE (K,s) 



VERIFIER COMBINES K AND 
MESSAGE M TO FORM INTEGER h 



VERIFIER COMBINES h, K, AND W„ USING 
FORM OF MODULUS p SELECTED AND 
CHECKS EQUALITY OF RESULT WITH sG 



FIG. 4 
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"REPLACEMENT SHEET' 



26_ 


SIGNER GENERATES ITS PRIVATE KEY w s 






i 




27_ 


SIGNER GENERATES PRIVATE INTEGER k s 




i 




28_ 


SIGNER COMBINES k s AND G TO FORM K 
USING FORM OF MODULUS p SELECTED 






I 




29_ 


SIGNER COMBINES K AND MESSAGE 
M TO FORM INTEGER h 





SIGNER COMBINES h, k s , AND 
w s TO FORM INTEGER s 










SIGNER SENDS MESSAGE M 
ALONG WITH SIGNATURE (h,s) 



FIG. 5 



32. 

33_ 

34_ 
35 



VERIFIER RETRIEVES PROVER'S PUBLIC KEY W p 



VERIFIER RECEIVES MESSAGE M 
ALONG WITH SIGNATURE (h,s) 










VERIFIER COMBINES h, W p , AND sG USING 
FORM OF MODULUS p SELECTED TO FORM K 



VERIFIER COMBINES K AND MESSAGE 
M TO FORM INTEGER h* 



36 — [ VERIFIER CHECKS EQUALITY OF h AND h' 

FIG. 6 
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Conclusion 

Any comments considered necessary by applicant must be submitted no 
later than the payment of the issue fee and, to avoid processing delays, should 
preferably accompany the issue fee. Such submissions should be clearly labeled 
"Comments on Statement of Reasons for Allowance." 

Any inquiry concerning this communication or earlier communications from 
the examiner should be directed to Tamara Teslovich whose telephone number 
is (571) 272-4241. The examiner can normally be reached on Mon-Fri 8-4:30. 

If attempts to reach the examiner by telephone are unsuccessful, the 
examiner's supervisor, Andrew Caldwell can be reached on (571) 272-3868. The 
fax phone number for the organization where this application or proceeding is 
assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from 
the Patent Application Information Retrieval (PAIR) system. Status information 
for published applications may be obtained from either Private PAIR or Public 
PAIR. Status information for unpublished applications is available through 
Private PAIR only. For more information about the PAIR system, see http://pair- 
direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 
free). 
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